FERPA
Family Educational Rights and Privacy Act
of 1974
(also known as the Buckley Amendment)
Winthrop University
Office of Records and
Registration
1. Review the basics rights under
FERPA
2. Look at federal clarifications
3. Discuss some case studies
4. Take a FERPA quiz
What is FERPA?
A Federal Law designed to protect the
privacy of education records.
Three basic FERPA rights:
1. Students have a right to inspect & review their
educational record.
a) Inspect and review within 45 days of the
request to inspect.
b) Students do NOT have the right under FERPA to
inspect:
 financial records of parents;
 letters of recommendation when the student has
waived, in writing, their right of access;
 information about other students
Three basic FERPA rights, continued:
2.
Students have a right to seek to amend address perceived inaccurate and misleading
data.
o
o
o
Right to a hearing if school refuses to amend
record.
Right to insert a statement.
This is NOT a right to dispute unsatisfactory
grade by a teacher.
Three basic FERPA rights, continued:
3. Students have a right to have some
measure of control over disclosure of
information from their educational record.
a) Student’s written permission is required before
releasing information from their record.
b) Consent must:
 Specify the records that may be disclosed (e.g.
grades, health, advising, disciplinary)
 State the purpose of the disclosure
 Identify the party or class of parties to whom a
disclosure may be made
 New
employees who work in Banner are expected
to complete basic FERPA training before being
given access to student information.
to student records in Banner (INB and
Wingspan) and DegreeWorks requires signing
a security policy which outlines appropriate use
and consequences for inappropriate use.
 Access
KEY FERPA TERMS
•
•
•
•
•
eligible student
education record
directory information
personally identifiable data
school official
An “eligible student” is a student who is or has
been enrolled at WU.
The Registrar defines “enrolled” as “registered for
classes” (and therefore has FERPA rights)
Applicants for admission have limited FERPA
rights.
 Records
for freshman applicants can be discussed
with parents.
 However,
covered.
transcripts from other institutions are
Eligible Student continued
FERPA is in effect - regardless of age.
 Once a student enrolls, FERPA rights revert
from parent to student.
 High school students taking college classes
have FERPA rights.
 However, the high school & postsecondary
institution may exchange information on
student without student’s written consent.
 Parental access would be gained through the
high school.
Educational records are:
Any record or materials which contain information where a
student can be personally identified AND
2. Are maintained by any office, employee, or agent of the
1.
university.





Electronic - an email, video conference,
internet, other electronic data.
Printed.
Handwritten notes.
Film, CD's, etc.
Graded tests, papers, assignments,
instructors' grade books.
Exceptions to “educational record”:
A. Sole Possession Notes: (aka Sole Source Notes)
 Kept in the sole possession of the person who created
them.
 Notes an instructor or staff member keeps notes on a student that no one else sees, never shared.
no one else was involved when creating the notes.
 Once shared with someone, or placed in an area where
may be accessed by others they become educational
records – and subject to FERPA and to subpoena.
B. Law Enforcement Records.
Kept apart, only for law enforcement purposes.
 Once shared with WU administrators/staff/faculty (e.g.
submitted for a committee to review) they become part
of student’s educational record.

C. Medical Treatment Records.
Records created by a WU health facility but used only by
professionals and disclosed only to individuals providing
treatment.
 Can become educational record if provided by student, e.g. to a
committee or to an instructor.
 Disclosure of “treatment records” are subject to FERPA not
HIPAA. Any record subject to FERPA is not subject to HIPAA.
 Disability records are educational records, not treatment
records.
More exceptions, cont.
D. Alumni Records:
▫ Only that information which is acquired after student has left the
university. (For example, where the alum is now employed.)
▫ All information gathered during time the alum was a student
remains protected by FERPA as part of the educational record.
E. Employee Records:
▫ Unless the employment is contingent upon school attendance,
(e.g. GA records, work study records) then human resource
records are not subject to FERPA.
Winthrop defines “directory information” as:
1. Student’s name
2. Address (but never residence hall address)
3. Telephone number
4. Email address
5. Place of birth (date of birth was removed as of November 2014)
6. Major and minor fields of study
7. Participation in officially recognized activities and sports
8. Height/weight of athletic team members
9. Date of admission
10. Dates of attendance (enrollment verification)
11. Classification (Freshman, etc.)
12. Degrees and awards received
13. Eligibility for honor societies
14. Most recent educational institution attended
15. Photographic, video or electronic images of students
If it is not on this list – don’t release it!
FERPA rules regarding directory information:
• Students must be notified of the items of directory
information. (This info is in the catalog and on our
website, and students are notified by email each semester.)
• If a data element isn’t explicitly defined as
directory information, it is not directory
information.
 It cannot be released without the student’s written
permission.
 Unless the release can be justified under one of the
exceptions in FERPA (e.g. school officials, regarding
financial aid application, subpoena).
•Students must be given the opportunity to request that
directory information NOT be released.
 At WU this is the Banner CONFIDENTIALITY flag.
 Banner CONFIDENTIALITY flag applies to nondisclosure of directory information only.
 CONFIDENTIALITY is requested, in writing, at the
Office of Records and Registration and once in effect
remains so until revoked by the student, in writing.
 All or nothing – can’t pick and choose directory items.
Directory Information Rules…..
If you see the Confidentiality note in
Banner:
Suggested response:
 “I have no information that I can release related
to that individual.”
Do not even confirm they are a student.
Sometimes these are situations involving personal
safety.
Confidential notation in Banner
This will appear on every screen in Banner:
Confidential Notation in Wingspan:
• The word “Confidential” will appear by the
student’s name.
By law, these are never directory information:
•
•
•
•
•
•
•
•
•
Student ID number
Social Security Number
Race/ethnicity
Gender
Grades
GPA
Country of citizenship/nationality
Religion
Academic Standing
The above are always subject to
FERPA protection!
1.
A data element unique to that individual: Social Security Number or
WU student ID number are “personal identifiers”.
2.
Direct identifiers: name of the student, the student’s parent, or other
family members.
3.
Indirect identifiers: date of birth, place of birth, mother’s maiden name,
etc.
4.
The student’s campus (residence hall) or home address.
5.
A list of personal characteristics or other information which alone or in
combination would make the student’s identity easily traceable.
While some of these may be directory information, you cannot
release any items that if disclosed alone, or together with another
data element, would allow “a reasonable person to reasonably
identify” an individual… per Jan.2009 US DOE FERPA
clarifications.
Review: basic student FERPA rights
1. Right to inspect and review everything in their record.
(Students have 24-hour access to grades through
Wingspan/DegreeWorks.)
2. Right to request changes to their educational records
and to appeal a decision of the university to not make
requested changes.
3. Right of some control over the disclosure of
information from their education record.
• Without a student's written permission, it is
a violation of FERPA to release nondirectory information to third parties
(unless it’s one of the “exceptions”).
Parents are a “third party”.
1. Right of access and control of information transfers from
the parent, to the student, when a student enrolls at a
postsecondary institution (regardless of age).
2. Parents may obtain non-directory information, (grades,
etc.), by obtaining a signed written consent from the
student.
3. Parents may obtain non-directory information
(grades, etc.) after it has been determined that their child is
legally their dependent, (IRS Tax form), at the
discretion of the institution - not required to do so
(“may” vs “must”).
• WU allows parent access to their student’s information
under this caveat.
FERPA exceptions to written consent rule:
Written consent to release non-directory information is NOT
required from the student when it involves:
1.
2.
3.
4.
5.
A “school official” with a legitimate educational interest or
education related "need to know“.
Other institutions where student has applied for admission, e.g.
requesting information such as a transcript.
U.S. Department of Education, or state/local education authorities
(e.g. SC Commission of Higher Ed).
Student’s request for financial aid, e.g. sending data to National
Student Clearinghouse.
Protecting the health or safety of the student or others.
▫ When there is an “articulable and significant threat” to the health or
safety of a student or other individuals.
▫ In an emergency FERPA allows a school disclose information to
appropriate parties without student consent (e.g. law enforcement,
medical personnel).
6. State/local officials in conjunction with legislative
requirements.
7. To comply with a judicial order or lawfully issued
subpoena.
8. To the victim of an alleged perpetrator of a crime of
violence, or nonforcible sex offense. (Clery Act)

Only the final results of the disciplinary proceeding
conducted by the institution with respect to alleged
crime/offense.
9. To parents of a student < 21 yrs., in connection with use or
possession of alcohol or controlled substance in violation of
law or policy.
Who is a “school official”……
A school official can be:
• A University administrator, faculty, or support staff, (including
law enforcement and health staff personnel).
• A member of the Board of Trustees.
• A company or individual contracted by college to perform a
special task such as the attorney, auditor, or collection agency.
• A student serving on an official committee, such as a disciplinary
or grievance committee, or assisting another school official in
performing his or her tasks.
• Definition: A school official has a legitimate
educational interest if the official needs to review an
education record in order to fulfill his or her
professional responsibility.
• FERPA dictates that a school official must have a
”legitimate educational interest” or need to know the
information before accessing an educational record.
 So…..no fishing expeditions about famous
alumni, friends, or relatives allowed!
FERPA expectations of WU:
1. Expectation of security—that information in education
records will be kept confidential.
2. Expectation that institutions use “reasonable methods”
to limit access of “school officials” to only those records
where there is a legitimate educational interest.
3. Expectation of tracking access to records – school is
responsible for ensuring that it is taking appropriate
measures to restrict and record access and disclosures.
4. Expectation of usage of “reasonable methods” to
authenticate identity of parents, students, school
officials, etc. to whom educational records are disclosed.
1.
2.
3.
4.
5.
Access to Banner, or any other repository of student
records where you work, does NOT authorize unrestricted
use of that student data.
Records should be used only in context of official business.
Curiosity does NOT qualify as legal right to know.
When in doubt, do not release information, directory or
otherwise. Feel free to contact the Office of Records and
Registration.
Oops!- an inappropriate release of information - could
harm a student if they have a need for confidentiality or
result in a violation of federal law and such complaints
trigger federal FERPA audits.
Notes for Faculty & Staff:
GRADES:
 Protect a student’s grades from being accessible by others. Never
post or leave in pick-up boxes with public access, or pass around the
room.
RECOMMENDATIONS:
 Any recommendation that references grades or academic standing in a
class must have the student’s written release. There is a form on the Rec
and Reg website which can be used for this purpose.
EMAIL:
 Do not discuss a student’s academic record via email unless it is a
Winthrop-issued email
STUDENT SPOUSES:
 Never release academic record information to a spouse without
written permission of the student or power of attorney. Spouses
have no rights to information.
When in doubt, refer the parent/guardian or spouse to
the Registrar or Assistant VP for Academic Affairs.
Balancing Student Privacy and School Safety…..the
Patriot Act of 2001
• Permits educational institutions to disclose without the
consent or knowledge of the student personally
identifiable information from the student’s education
records to the Attorney General of the United States in
response to an ex parte order in connection with the
investigation or prosecution of terrorism crimes.
• Ex parte order is an order issued by a court of competent
jurisdiction without notice to a possible hostile party.
Balancing privacy and safety…continued
• As a result, FERPA, as amended, does not
require a school official to record a disclosure of
information from a student’s education record
when the school makes that disclosure pursuant
to an ex parte order.
• In other words, we don’t have to tell the student
we made the disclosure.
Balancing Student Privacy and School Safety…..
per U.S. Department of Education, 2007.
This amendment came out of the 2007 Virginia Tech shootings:
A school official (includes faculty) can in general share with a
parent personal knowledge or an observation about a
behavior of a student without a student’s written consent.
Examples:
OK to speak to responsible parties about observations or direct
information.
 You see two students get into a fight.
 A student tells you something directly, and you are concerned.
Not OK to share anything derived from their academic record.
 You know from personal knowledge that a student is failing.
Balancing Student Privacy and School
Safety… continued
• A school official can share with medical
personnel, law enforcement officials, and public
health officials (as well as parents) records and
information about a student without a student’s
written consent.
• Only good for the time period of the emergency.
Question…
Scenario:
Local police call, a person claiming to be a student has been
arrested.
 You know that the police has a policy of releasing an arrested
student for minor infractions, (what is involved in this case), if
they can verify that the person is a student.
 You check Banner and find the person is currently enrolled at
WU but has a CONFIDENTIALITY flag.
Do you verify to the officer that this person
is a student?
You respond:
“I have no information that I can release
on that individual.”
You are honoring the student’s FERPA right of nondisclosure.
Question…
True or False?
Deceased student’s educational records are
still protected under FERPA.
False.

The privacy interests of an individual expire
with that individual’s death.

So, NO, deceased students are not protected by
FERPA.
Consider this situation….
A faculty member has an emergency and must
leave class before distributing test results to
his students. He leaves the graded exams in a
pile on the desk and instructs the student to
pick them up themselves.
Is this distribution method in
compliance with FERPA?
NO – This method of grade distribution is a
VIOLATION of FERPA and could subject
the faculty and the University to a formal
complaint.
Why? Because while trying to locate their
own exam results the students would have
access to other student’s data.
Question…
Someone calls claiming they are a student and wants
you to discuss information from their educational
record….they offer to give you the last 4 digits of the
SSN as they do not remember their WU ID.
Can you verify their identity based upon the
last 4 digits of the SSN, and their name?
Would this practice be FERPA compliant?
NO – you may not do this.
“ confirming
directory information based on
the last four digits of the SSN would not be
permitted under FERPA. This equates to
confirming the SSN which the new
regulations specifically prohibit, absent
written consent from the student.”
LeRoy S. Rooker, Senior Fellow AACRAO
and former director of U.S. DOE FERPA
Compliance Office.
Question…
A student has asked you to write a
recommendation for a job. Which of the following
can you disclose without the student specifying in
their request?
A. Grades in your class
B. Work ethic
C. Grasp of the subject material
B and C
The student must specify if he or
she wants her grade in your class
to be released. The others are
observations.
Question……..
You go to the copier and find a student’s transcript
on the glass. Do you..
a. Throw it in the trash
b. Take it back to your office and inform Records
and Registration.
c. Put it back on the glass when you’re done with
your own copying.
Answer…
B (take it back to your office and inform
Records and Registration)
True or False:
1. A student has a right to inspect information in his
or her file in the Registrar’s Office and in his or her
academic home department or college.
TRUE
2. Faculty have a right to inspect education records of
any student attending WU without giving a reason.
FALSE = only if they have a
legitimate educational purpose
3. WU must release, to anyone, upon request, any
information identified as directory information by the
institution.
FALSE = they “may” --it is at
the discretion of the institution
4. Currently attending WU students have the right
under FERPA to request that all of their educational
records not be disclosed, to anyone, and WU must
comply.
FALSE = confidentiality rights only
apply to directory information
5. Parents may obtain confidential information from their
student’s academic record.
TRUE = if student is a dependent, WU “may”
legally decide to release information
6. A WU student’s degree can be confirmed to some
external source without first obtaining the permission
of the student.
TRUE = degree is directory information
True or False—one more
7. A former student is involved in a lawsuit and
some of his records have been made public. A
reporter from the Herald calls and wants to
discuss these records. It is OK to do this.
False
Review…….KEY FERPA CONCEPTS…
1. Written permission required for disclosure of student
education record:
 If it’s not Directory Information – don’t release it.
2. Exceptions to written permission rule exist:
 Entities (school officials) with Legitimate Educational Interest
 Financial aid providers and authorities
3. Students have right to access & review their records, and
due process for complaints.
4. Parents/parental disclosure –
 Parents may have access if they can produce current tax return
which shows student is a dependent.
FERPA website
AUTHORITATIVE SOURCES
This PowerPoint presentation used by permission from
Tina Davis, Registrar, Eastern Kentucky University. It
was revised and added to in order to fit
Winthrop University’s practices.
LeRoy Rooker , Senior Fellow AACRAO and former
Director – US DOE Family Policy Compliance Office.
One Dupont Circle, NW. Washington DC 20036
AACRAO FERPA Guide. 2006. American
Association of Collegiate Registrars and Admissions
Officer. Dennis Hicks, managing editor.
The FERPA Answer Book for Higher
Educational Professionals. 2009. Aileen Gelpi,
Esq., and Clifford A Ramirez. Wiley Periodicals, Inc. A
Wiley Company.
U.S. Dept. of Education. Family Policy
Compliance Office.
 ferpa@ed.gov;
www.ed.gov/policy/gen/guid/fpco/index.html
Contact Information
Gina Jones, Registrar
126 Tillman
323-3692
jonesgg@winthrop.edu
Tim Drueke, Assistant VP for Academic Affairs
126 Tillman
323-4862
drueket@winthrop.edu